ejabberd: ldap_filter in LDAP Active Directory

Nec

8/12/23, 2:10 PM

TL;DR: How to setup ejabberd to only allow some Active Directory group members?

Hello,

After having successfully set up an ejabberd service plugged in to our AD, I'd like to narrow the allowed users to a specific group.

My working setup is :

auth_method: [ldap]
ldap_servers:
  - 1.2.3.4
  - 1.2.3.5
ldap_uids:
  mail: "%[email protected]"
ldap_base: "OU=FON,OU=Domain,OU=Global,DC=domain,DC=lan"
ldap_rootdn: "CN=someone,CN=Users,DC=domain,DC=lan"
ldap_password: "secret"

This is working fine as is.

The users are stored in :

"OU=Utilisateurs,OU=FON,OU=Domain,OU=Global,DC=domain,DC=lan"

but the groups are stored in another OU :

"OU=Securite,OU=Groupes,OU=FON,OU=Domain,OU=Global,DC=domain,DC=lan"

I'd like to add a filter to allow only users contained in a group which is defined in another OU.

When trying to add the filter below, zero user in the allowed group can connect :

ldap_filter:
  (&(objectCategory=group)(CN=GG_XMPP_USERS,OU=Securite,OU=Groupes,OU=FON,OU=Domain,OU=Global,DC=domain,DC=lan))

To no avail, I also tried some syntax looking like : (&(objectclass=group)(|(cn=admingroup)(cn=group1)(cn=group2)))

In Active Directory, the user objects have no "memberOf" attribute one could query.

So what is the correct way to go?

0 + 0

active-directory

ldap

groups

ejabberd

Manu

8/14/23, 7:49 AM

(&(objectClass=user)(memberof=CN=GG_XMPP_USERS,OU=Securite,OU=Groupes,OU=FON,OU=Domain,OU=Global,DC=domain,DC=lan)) I guess

Nec

8/25/23, 1:29 PM

Thank you @Manu, this was the correct way to go. You're great.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: ejabberd: ldap_filter in LDAP Active Directory

TH: ejabberd: ldap_filter ใน LDAP Active Directory

RO: ejabberd: ldap_filter în LDAP Active Directory

RU: ejabberd: ldap_filter в LDAP Active Directory

VI: ejabberd: ldap_filter trong LDAP Active Directory

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.